1 

2 
3 
4 
5 
6 
7 
8 
9 

10 
11 

12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 



Case 2:13-cr-00082-KJM Document 1 Filed 03/14/13 Page 1 of 9 



FILED 



BENJAMIN B. WAGNER 
United States Attorney 
MATTHEW D. SEGAL 
Assistant United States Attorney 
501 I Street, Suite 10-100 
Sacramento, CA 95814 
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JAMES A. SILVER 
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Washington, DC 20530 
Telephone: (202)514-1026 




Attorneys for Plaintiff 
United States of America 



IN THE UNITED STATES DISTRICT COURT 



UNITED STATES OF AMERICA, 

Plaintiff, 



EASTERN DISTRICT OF CALIFORNIA 

1 3 - CR 8 2 KJM 



V. 



MATTHEW KEYS, 



Defendant. 



CASE NO. 

VIOLATIONS: 18 U.S.C. § 371 - Conspiracy to 
Cause Damage to a Protected Computer; 
18 U.S.C. § 1030(a)(5)(A) -Transmission of 
Malicious Code; 18 U.S.C. § 1030(a)(5)(A) AND 
1030(b) -Attempted Transmission of Malicious 
Code; 18 U.S.C. § 982 (a)(1), 1030(i)(l)(A), AND 18 
U.S.C. § 982 (a)(2)(A)- Forfeiture Allegation 



INDICTMENT 

COUNT ONE: [18 U.S.C. § 371 - Conspiracy to Cause Damage to a Protected Computer] 
The Grand Jury charges: 

MATTHEW KEYS, 

defendant herein, as follows: 
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I. INTRODUCTION 

1 . At all times relevant to this Indictment: 

a. Defendant MATTHEW KEYS was an individual residing in Sacramento County 
in the State and Eastern District of California. 

b. Tribune Company was a Delaware corporation that owned, among other media 
outlets, the Los Angeles Times newspaper and the Sacramento, California-based television station 
KTXL FOX 40 ("Fox 40"). 

c. Tribune Company used a content management system ("CMS") to publish web 
versions of news stories from television stations and newspapers owned by Tribune Company. 

d. Internet Relay Chat ("IRC") was an Internet-based system that allowed its users, 
located worldwide, to send and receive live messages to single or multiple recipients within various IRC 
channels, or discussion areas. 

e. Anonymous was a group of Internet users that had claimed responsibility for 
intruding into, vandalizing, and disabling computer systems of governments and private entities. 

f. "Sharpie" was the nickname of an Anonymous member. 

g. MATTHEW KEYS was a recently terminated employee of Fox 40 and used the 
nickname "AESCracked" for his IRC communications with members of Anonymous. 

II. CONSPIRACY 

2. Between on or about December 8, 2010, and or about December 15, 2010, in the State 
and Eastern District of California and elsewhere, the defendant, MATTHEW KEYS, together with at 
least one other person, did conspire to knowingly cause the transmission of a program, information, 
code, and command, and, as a result of such conduct, intentionally caused damage without authorization 
to a protected computer, causing loss to a person during a 1-year period aggregating at least $5,000 in 
value, in violation of 18 U.S.C. § 1030(a)(5)(A) and (c)(4)(B), all in violation of Title 18 United States 
Section, Code 371. 

/// 
/// 

Indictment 2 
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III. OBJECTS 

3. The conspiracy had the following objects, among others: to make unauthorized changes 
to web sites that Tribune Company used to communicate news features to the public; and to damage 
computer systems used by Tribune Company. 

IV. MANNER AND MEANS OF THE CONSPIRACY 

The conspiracy used several means to accomplish the objects of the conspiracy, including the 
following: 

4. Participants identified Tribune Company, Fox 40, and The Los Angeles Times as targets 
for online intrusion and web vandalism; 

5. It was part of the conspiracy to share at least one username and password combination 
that could be used to log in and make changes to Tribune Company's CMS; 

6. It was part of the conspiracy to obtain control of at least one additional username and 
password combination that could be used to log in and make changes to Tribune Company's CMS; 

7. It was part of the conspiracy to login without authorization to Tribune Company's CMS 
for the purpose of learning how to alter and damage it; and 

8. It was part of the conspiracy to alter the online version of a news feature published on the 
web site of the Los Angeles Times. 

V. OVERT ACTS 

In furtherance of the conspiracy, and to accomplish the objects of the conspiracy, at least one 
member of the conspiracy committed and caused to be committed various overt acts within the Eastern 
District of California and elsewhere, including, but not limited to, the following: 

9. On or about December 8, 2010, individuals identifying themselves as members of 
Anonymous had a conversation in an IRC channel known as #internetfeds in which one conspirator 
expressed a desire to gain unauthorized access to computer systems of Fox, a media outlet. 

1 0. Defendant MATTHEW KEYS, using the nickname AESCracked, responded that "it 

takes a while to grant one username permission to every site. I'm doing that now." Thereafter, KEYS 

was invited to join the IRC channel #internetfeds. 
Indictment 3 
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1 1 . Defendant MATTHEW KEYS then told the unidentified individuals that he was a former 
employee, proceeded to give them a username and password, and told them to "go fuck some shit up." 

12. Between on or about December 8, 2010 and on or about December 14, 2010, at least one 
member of the conspiracy used the anonl234 username and corresponding password to reconnoiter the 
Tribune Company CMS to ascertain how it worked and how best to accomplish the objectives of the 
conspiracy. 

13. On or about December 1 1 , 20 1 0, a member of the conspiracy began using the username 
ngarcia on the Tribune Company CMS. 

14. On or about December 1 4 and 1 5, 20 1 0, a member of the conspiracy used the username 
ngarcia to alter content in a Los Angeles Times news story published on the Tribune Company CMS to 
read as follows: 



Pressure builds in House to elect CHIPPY 1337. 

House Democratic leader Steny Hoyer sees 'very good things' in the deal cut which will 
see uber skid Chippy 1337 take his rightful place, as head of the Senate, reluctant House 
Democrats told to SUCK IT UP. 

By CHIPPYS NOl FAN 



15. On or about December 1 5, 2010, defendant MATTHEW KEYS, who was using the 
online nickname "AESCracked," engaged in the following conversation and did the things reflected in 
the conversation: 



sharpie: 
sharpie: 
sharpie: 



http://[WEB ADDRESS REDACTED] 
I taught myself the dystem using ngarcia 
* system 



AESCracked: 

sharpie: 

AESCracked: 



LOL 



and had a whole front page layout made for the Chicago tribune 
Is it live? 

but dam there sysadmins were good 

nah they killed me 

that was up for l A hr 

Screenshot? 

no 

sucks 

the I menat the LA Times was up for Vi hr 
I can grant you access again 
that would be great 



sharpie: 
sharpie: 
sharpie: 



AESCracked: 



sharpie: 

AESCracked: 

sharpie: 



AESCracked: 
sharpie: 
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sharpie: I know ho to use it now 

AESCracked: Standby 

AESCracked: Have to VPN to cover my tracks. 

AESCracked: Oh I already am, nvm 

sharpie: and I see that you can do a bunch of different layouts on different 
papers 

AESCracked: damn they cut off my account 

sharpie: and have them all go live at the same time 

AESCracked: hang on. 

AESCracked: Nope, I'm locked out for good. 

sharpie: fuck 

AESCracked: :( 

sharpie: yeah 

AESCracked: Let me see if I can find some other users/pass I created while there, 

sharpie: all those other accounts were dead in minutes and they found 

ngarcia damn quick 

sharpie: I got to give props to the stsadmins 

sharpie: *sysadmins 

AESCracked: LOL. 

sharpie: anyjoy? 

AESCracked: Not yet 

sharpie: kay bro 

AESCracked: Will check a little later for sure 

sharpie: afk 5 mins anyway 

sharpie: cool 

sharpie: :0 

AESCracked: I have a hard drive full of Tribune crap, but it's in another location, 

sharpie: thanks 

AESCracked: Sure thing 

sharpie: that was such a buzz having my edit 

sharpie: on the LA Times 

AESCracked: Nice 

sharpie: I could have done so much more if I'd known thr interface at the 

start 

sharpie: it' s both easy and complicated 



All in violation of Title 18, United States Code, Section 371. 

COUNT TWO: [18 U.S.C. § 1030(a)(5)(A) and (c)(4)(B)-Transmission of Malicious Code] 

The Grand Jury further charges: THAT 

MATTHEW KEYS, 

defendant herein, as follows: 

1. The allegations set forth in Paragraphs 1 and 3 through 15 of Count 1 are realleged as if 
fully set forth herein. 
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2. Between on or about December 8, 2010, and on or about December 15, 2010, within the 
State and Eastern District of California and elsewhere, the defendant, MATTHEW KEYS, did 
knowingly transmit a program, information, code, and command, and, as a result of such conduct, 
intentionally caused damage without authorization to a protected computer, and the offense caused loss 
to a person during a 1-year period from the defendant's course of conduct affecting a protected computer 
aggregating at least $5,000 in value, in that the Tribune Company spent over $5,000 responding to the 
attack, conducting a damage assessment, and restoring the system to its prior condition, in violation of 
Title 18 United States, Code, Section 1030(a)(5)(A), Section (c)(4)(B), and 2. 

COUNT THREE: [18 U.S.C. § 1030(a)(5)(A) AND 1030 (b)-Attempted Transmission of 
Malicious Code] 

The Grand Jury further charges: THAT 

MATTHEW KEYS, 

defendant herein, as follows: 

1. The allegations set forth in Paragraphs 1 and 3 through 15 of Count 1 are realleged as if 
fully set forth herein. 

2. On or about December 1 5, 2010, within the Eastern District of California and elsewhere, 
the defendant, MATTHEW KEYS, did knowingly attempt to cause the transmission of a program, 
information, code, and command, and as a result of such conduct, intentionally to cause damage without 
authorization to a protected computer, which conduct would, if completed, have caused loss to a person 
during a 1-year period aggregating at least $5,000 in value, in violation of Title 18 United States Code, 
Section 1030(a)(5)(A), Section 2, and (c)(4)(B). 

FORFEITURE ALLEGATION : [18 U.S.C. §§ 982(a)(1), 1030(i), and 18 U.S.C. § 982(a)(2)(A)- 

Criminal Forfeiture] 

1 . Upon conviction of any of the offenses alleged in Counts One through Three of this 
Indictment, defendant MATTHEW KEYS shall forfeit to the United States of America, pursuant to Title 
18 United States Code, Sections 982(a)(1) and 1030(i), all property, real or personal, used or intended to 
be used to commit or to facilitate the commission of such violation; and any property, real or personal, 
constituting or derived from any proceeds that he obtained, directly or indirectly, as a result of such 
Indictment 6 
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violation, including: 

a. One MacBook Pro, serial number W88091 MYJY; and 

b. One Toshiba hard drive, serial number X83GF1 CHSEM8. 

2. If any property subject to forfeiture, as a result of the offenses alleged in Counts One 
through Three of this Indictment: 

a. cannot be located upon the exercise of due diligence; 

b. has been transferred or sold to, or deposited with, a third party; 

c. has been placed beyond the jurisdiction of the Court; 

d. has substantially diminished in value; or 

e. has been commingled with other property which cannot be divided without 
difficulty; 

it is the intent of the United States, pursuant to pursuant to 18 U.S.C. § 982(b)(1) and 28 U.S.C. § 
2461(c), incorporating 21 U.S.C. § 853(p), to seek forfeiture of any other property of said defendant up 
to the value of the property subject to forfeiture. 

A TRUE BILL. 



/s£5ign tore Grrflle w/AUSA* 



FOREPERSON 




BENJ^ITN B. WAGNER 
United States Attorney 
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Penalty Slip 



Matthew Keys 



Count One 

Violation: 
Penalty: 



Count Two 

Violation: 
Penalty: 



Count Thr ee 

Violation: 



Penalty: 



18 U.S.C. § 371- Conspiracy to Cause Damage to a Protected Computer 

A maximum of 5 years imprisonment, or 

A fine of $250,000 or, both 

3 years of Term of Supervised Release 

18 U.S.C. 1030(a)(5)(A)- Transmission of Malicious Code 

A maximum of 1 years imprisonment, or 

A fine of $250,000 or, both 

3 years of Term of Supervised Release 

18 U.S.C. § 1030(a)(5)(A) and 1030(b)- Attempted Transmission of Malicious 
Code 

A maximum of 10 years imprisonment, or 

A fine of $250,000 or, both 

3 years of Term of Supervised Release 



Forfeiture Allegation: 

Violation: 1 8 U.S.C. 982(a)(1), 2030(i)(l)(A), AND 1 8 U.S.C. § 982(a)(2)(A)-Criminal 
Forfeiture 

Penalty: As indicated in the Indictment 



Special Assessment: $100.00 each count 
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UNITED STATES DISTRICT COURT 

Eastern District of California 
Criminal Division 



THE UNITED STATES OF AMERICA 

vs. 

MATTHEW KEYS 



INDICTMENT 

VIOLATION(S): 18 U.S.C. § 371 - Conspiracy to Cause Damage 
to a Protected Computer; 18 U.S.C. § 1030(a)(5)(A) - Transmission 
of Malicious Code; 18 U.S.C. § 982 (a)(1), 1030 (i)(l)(A), AND 18 
U.S.C. § 982 (a)(2)(A) - Forfeiture Allegation 



A true bill, 



Ttirefrian. 



Filed in open court this / day 

of _ _hnMs4j~Z . A.D. 20 _/3_ 




Bail, $ £^^°i^r<^3 lA^t-^C 

/4_^^ r L = _H 1 



GPO 863 525 



